Digitalization is continuing facilitating our daily lives. The world is interconnected as never before, bringing close people, businesses, or other organizations. However, hackers are also coming close. New business and operational models require the collection and processing of massive amounts of data in real-time, involving utilization of complex information systems, large supply-chains, personal devices, etc. These impose several advantages for adversaries on the one hand (e.g., poorly protected or monitored elements, slow fashion of security updates/upgrades in components that gain little attention, etc.), and many 
difficulties for defenders on the other hand (e.g., administrate large and complex systems with high dynamicity) in this cyber-security interplay.

This paper presents a swarm-intelligence solution for incident handling and response. Cyber Threat Intelligence (CTI) is continuously integrated in the system (i.e., MISP, CVEs, STIX, etc.), and Artificial Intelligence (AI) / Machine Learning (ML) are incorporated in the risk assessment and event evaluation processes.

This work has received funding from the European Union’s Horizon 2020 research and innovation programmes under grant agreements No. 883273 (AI4HEALTHSEC), No. 101021659 (SENTINEL), No. 957337 (MARVEL), and No. 101070599 (SecOPERA).